Meziantou.Framework

HSTS

edit

HTTP Strict Transport Security (HSTS, RFC 6797) lets a host declare that it must only be reached over HTTPS. Browsers honor it; HttpClient does not: a request to http://github.com is sent in plaintext. HstsClientHandler, in the Meziantou.Framework.Http.Hsts package, closes that gap. Before a request is sent, it rewrites http:// to https:// when the host has an HSTS policy.

dotnet package add Meziantou.Framework.Http.Hsts

The policies come from two places:

  • The preload list: the hosts that ship preloaded in the browsers, github.com among them, are built into the package. A request to them is upgraded from the first one.
  • The Strict-Transport-Security header: when an HTTPS response carries it, the handler remembers the host, and the next requests to it are upgraded.

The policies are kept in an HstsDomainPolicyCollection, which you can also query and edit yourself.

Pages of this group

  • Upgrading requests: add the handler to an HttpClient, what it upgrades and how it reads the Strict-Transport-Security header.
  • Managing policies: add, check and remove policies, share or isolate a collection, and the limits that protect it.
  • Redirects: how the handler follows redirects so that every hop is upgraded, and what it changes on your inner handler.
  • The preload list: what the built-in list contains and how to turn it off.